Is it actually a given that these C functions could fail? It is certainly not apparent from their function signatures, as you already mention. :) If it just wri

Is it actually a given that these C functions could fail? It is certainly not apparent from their function signatures, as you already mention. :) If it just writes to some memory mapped I/O registers then it might well not be possible to fail that (unless writing memory in general has become impossible, but at that time no software will save you anymore). In any case let's not judge the writers too harshly for omitting some error checking in the very first complete example they provide in the manual. The typical introductory "hello world" program also doesn't contain error handling to check if writing to stdout succeeded or not. A real CoPilot program could (and should!) have a separate stream for checking `heaterStatus` and raise a separate alarm if the status of the heater does not update when it should.